From nobody Mon Apr 14 14:07:38 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Zbpyg0xnjz5ssgp; Mon, 14 Apr 2025 14:07:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Zbpyg08mGz3Qgb; Mon, 14 Apr 2025 14:07:39 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1744639659; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=15O0WLwKhWUi9V03wTptsB2AhsxcmcweybcyZgTRwuA=; b=NVX3wSOsRgeAIgMqbPohtDqBCgElA0KeuHxFaqPflOLqWFjMV2rrbWCCbEk0kMj08qh4DY JBdUbU7hZ/MNkoqckMReyTOlOnIBBliUzt2oWlqpKRKN0eox3/H6pHqFrvgVDvSOkUGUUa sRDCetsEVsjm7rNgR3XmUkkK4+uC920vJ4h669h4w4LI0q6ko5c5XePjhYJ4KR+aaDr2XB cpSwYIh67Nzewp0cbxynV6/cKaZX8+aZpKlSvrL/PIM+aAaYEMEdjCErzVnYofwMWq07NT hUCvt0zhQ5M40v2hrhwtOKaIjKkmxmXEvAgiAo4Sh9U8vrdC52AN0+rUE1jEPw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1744639659; a=rsa-sha256; cv=none; b=JUxc64RmI7m8JreRuf7OYWCUrEK9Ak7/LMx8zZWA9SnC4gQGXq8OTSUTs2pjzj5XAcXI+N 6/fOqMXbRjOEb1bZuuMxiVaXnFJPjEJYAX3igw6Um8kGQmZvSaJDcPvEGrVhruqWj1EveA wjVd2qxbIGl3fnYpSS3H2XM52eAJU0qq6iGjfjQuAHkeeMj0dHvg5TLBWgBp+HL/skp3RZ nKaIeCwyxEO5ZUx0PmJCeq9vgH0dGa9+S1od8pRyRUYizKsiCxPqxINjD6xG6icZQ0YPeS gTZA5TJIIxhNByl+fAJJKX13zVJ2xCoOpK6uQiHIfgUrpEkXudaWaDutLJFHTw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1744639659; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=15O0WLwKhWUi9V03wTptsB2AhsxcmcweybcyZgTRwuA=; b=L0NQP5l2/0a7OwE/WAQoR17i9q1rhjWiSg6Hh1r8YFv9KejLjL9CuW2x7kBdoXcTVQvlot 3+F+i3u3Wj8UXmPKlBM8ialKEvB2ZOCwe6hxZ6Jv8wqYjomXqg02l5KifC/QxsT7Uiic7o DvjmUgsSyB1oUBxX/xj4D4dZssiK83PpbWD2bG+MTT18WbDqc0QR8AKnCm8aDdABlAJZCk Raa1aT52m8rPXJp4wFGiVN46tyV74i3o0qouGN3/Fyj0FEEFp3Xw6UscoEzex46IXbW57d teVAdz+n10utXzFXzUUbkQWJS1ffuawVzYz7kS/6oWefSClDLaG+iFITrRWoxw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Zbpyf6h79zs1b; Mon, 14 Apr 2025 14:07:38 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 53EE7cGj032377; Mon, 14 Apr 2025 14:07:38 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 53EE7cj2032374; Mon, 14 Apr 2025 14:07:38 GMT (envelope-from git) Date: Mon, 14 Apr 2025 14:07:38 GMT Message-Id: <202504141407.53EE7cj2032374@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: "Bjoern A. Zeeb" Subject: git: c816f64e66a0 - main - LinuxKPI: 802.11: plug mbuf leak List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: c816f64e66a0d21196ede35da3eca19e54b59a03 Auto-Submitted: auto-generated The branch main has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=c816f64e66a0d21196ede35da3eca19e54b59a03 commit c816f64e66a0d21196ede35da3eca19e54b59a03 Author: Bjoern A. Zeeb AuthorDate: 2025-04-13 16:13:22 +0000 Commit: Bjoern A. Zeeb CommitDate: 2025-04-14 14:06:50 +0000 LinuxKPI: 802.11: plug mbuf leak Now that we are doing VHT it is possible to overflow the mbufqs we use in the TX and RX paths. Check the return code of mbufq_enqueue() deal with any error accordingly and propagate it. Sponsored by: The FreeBSD Foundation MFC after: 3 days --- sys/compat/linuxkpi/common/src/linux_80211.c | 32 +++++++++++++++++++++++++--- 1 file changed, 29 insertions(+), 3 deletions(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index 149926a54907..73e1e7b1e1ad 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -4519,6 +4519,7 @@ lkpi_ic_raw_xmit(struct ieee80211_node *ni, struct mbuf *m, const struct ieee80211_bpf_params *params __unused) { struct lkpi_sta *lsta; + int error; lsta = ni->ni_drv_data; LKPI_80211_LSTA_TXQ_LOCK(lsta); @@ -4542,7 +4543,21 @@ lkpi_ic_raw_xmit(struct ieee80211_node *ni, struct mbuf *m, } /* Queue the packet and enqueue the task to handle it. */ - mbufq_enqueue(&lsta->txq, m); + error = mbufq_enqueue(&lsta->txq, m); + if (error != 0) { + LKPI_80211_LSTA_TXQ_UNLOCK(lsta); + /* + * Free the mbuf (do NOT release ni ref for the m_pkthdr.rcvif! + * ieee80211_raw_output() does that in case of error). + */ + m_free(m); +#ifdef LINUXKPI_DEBUG_80211 + if (linuxkpi_debug_80211 & D80211_TRACE_TX) + ic_printf(ni->ni_ic, "%s: mbufq_enqueue failed: %d\n", + __func__, error); +#endif + return (ENETDOWN); + } taskqueue_enqueue(taskqueue_thread, &lsta->txq_task); LKPI_80211_LSTA_TXQ_UNLOCK(lsta); @@ -6416,7 +6431,7 @@ linuxkpi_ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb, struct ieee80211vap *vap; struct ieee80211_hdr *hdr; struct lkpi_sta *lsta; - int i, offset, ok; + int i, offset, ok, error; uint8_t rssi; bool is_beacon; @@ -6627,7 +6642,18 @@ skip_device_ts: goto err; } - mbufq_enqueue(&lhw->rxq, m); + error = mbufq_enqueue(&lhw->rxq, m); + if (error != 0) { + LKPI_80211_LHW_RXQ_UNLOCK(lhw); + m_freem(m); + counter_u64_add(ic->ic_ierrors, 1); +#ifdef LINUXKPI_DEBUG_80211 + if (linuxkpi_debug_80211 & D80211_TRACE_RX) + ic_printf(ni->ni_ic, "%s: mbufq_enqueue failed: %d\n", + __func__, error); +#endif + goto err; + } taskqueue_enqueue(taskqueue_thread, &lhw->rxq_task); LKPI_80211_LHW_RXQ_UNLOCK(lhw);